News

Satellite communications giant Viasat was also targeted by Salt TyphoonThe company found unauthorized access via a compromised deviceBreadth of attacks highlights Salt Typhoon's threat to US commsAnother victim of the massive Salt Typhoon cyberattack which targeted US telecommunications giants has been identified as Viasat.Bloomberg News reports the company found a breach in its systems earlier in 2025 linked to the wider attacks against US communications infrastructure, as the satellite communications company was working with the country's government.Viasat has numerous contracts and partnerships across the maritime, aviation, and networking industries, alongside several contracts with the US Department of Defense and US Space Force.Satellite comms targeted by Salt TyphoonThe attack in 2024 saw the Chinese-linked Salt Typhoon group hack into numerous networks belonging to telecommunications companies such as Verizon, AT&T, and Lumen, which likely gave the hackers access and record calls and messages. The group also allegedly breached a backdoor system used by US authorities to carry out court-ordered wiretaps.Moreover, the Salt Typhoon group also hit the presidential campaigns of both Kamala Harris and Donald Trump in the run up to the 2024 US presidential election.China has frequently denied having any links to the hacking group, even going so far as to accuse the CIA of being behind attacks committed by another Chinese-linked group, Volt Typhoon.Following Viasat’s investigations into the breach which occurred via unauthorized access through a compromised device, the company said it had found no customer impact following the attack.“Viasat believes that the incident has been remediated and has not detected any recent activity related to this event,” the company said.The full impact of the Salt Typhoon attack may never be known as huge cuts to government departments and advisory boards were made immediately following President Trump’s return to the White House.The main investigation being pursued by the Cyber Safety Review Board (CSRB) was cancelled after the advisory board was axed to “eliminate a misuse of resources,” according to former acting Deputy Secretary of the Department of Homeland Security, Benjamin C. Huffman.You might also likeThese are the best business VPNsTake a look at the best business password managersOne of the biggest flaws exploited by Salt Typhoon hackers has had a patch available for years

The Sitecore CMS had an account with a hardcoded passwordThreat actors could use it to upload arbitrary files, achieving RCEThousands of endpoints are potentially at riskSitecore Experience Platform, an enterprise-level content management system (CMS) carried three vulnerabilities which, when chained together, allowed threat actors full takeover of vulnerable servers, experts have warned.Cybersecurity researchers watchTowr found the first flaw is a hardcoded password for an internal user - just one letter - ‘b’ - making it super easy to guess.The account does not have admin privileges, but watchTowr found malicious users could authenticate via an alternate login path, which would give them authenticated access to internal endpoints.Save up to 52% off Lifelock Identity Theft Protection!Your personal info is in endless places. And any one of them could accidentally expose you to identity theft. That's why LifeLock monitors hundreds of millions of data points a second for identity theft. LifeLock. For the threats you can't control.Preferred partner (What does this mean?)View DealPatching the flawsThis sets the stage for the exploitation of the second flaw, described as a “Zip Slip” in the Sitecore Upload Wizard.In a nutshell, the now-authenticated attackers can upload malicious files due to insufficient path sanitation, and the way Sitecore maps paths. As a result, they can write arbitrary files in the webroot.These two issues alone could be enough to cause some serious damage on the compromised server, but the problems don’t stop there.If the website has the Sitecore PowerShell Extensions (SPE) module installed, which is commonly bundled with SXA, attackers can upload arbitrary files to specific paths, bypassing extension or location restrictions and resulting in a “reliable RCE”.All Sitecore versions from 10.1 to 10.4 are apparently vulnerable, which translates to roughly 22,000 publicly exposed instances, at press time - but just because they’re all accessible and running these versions, it doesn’t necessarily mean they’re all vulnerable."Sitecore is deployed across thousands of environments, including banks, airlines, and global enterprises — so the blast radius here is massive," watchTowr CEO Benjamin Harris told BleepingComputer."And no, this isn't theoretical: we've run the full chain, end-to-end. If you're running Sitecore, it doesn't get worse than this – rotate creds and patch immediately before attackers inevitably reverse engineer the fix."So far there were no reports of abuse in the wild, but a patch is available now, so users should update as soon as possible.You might also likeSchneider Electric says developer platform was breached, company data stolenTake a look at our guide to the best authenticator appWe've rounded up the best password managers